Privacy Policy

Effective 25 October 2026

1. The short version

We collect as little as the service needs. You can use the app with no account: then your data stays in your browser, and the server keeps nothing about you. An account is your email, and we store only a one-way hash of it, never the address. We do not ask for your name or a password. We count visits with our own analytics, which sets no cookie. We show no ads, and we sell nothing.

2. What the server keeps

• A hash of your email. A one-way Argon2 hash with a secret key, which is not in the database. We never store the address. When you sign in, we hash the address that you type to find your account, send a code to it, and forget it. Without the key, nobody can test an address against the hash.
• Your progress and your list of repositories, so that your devices stay in step. For a repository, the server keeps its address and its branch or tag, not its content.
• The version of these terms that you agreed to, and the time.
• Your sessions, as a hash of a random token. A session ends after 30 days, or when you sign out.
• A sign-in code, as a hash, for 10 minutes.
• Counters of attempts for each IP address and each email hash, to stop abuse. A counter goes away about one hour after it starts.

The server logs no email address and no IP address. The machine in front of the server can log the IP address and the path of each request, for security.

3. Visits

We count visits with Umami, which we run on our own server. Your browser loads it from this site, and it reports to this site. It sets no cookie and keeps nothing in your browser. For each page view, it records the page and its title, the page you came from, your browser, your operating system, your screen size and your language, and the country, region and city that your IP address points to. It does not store the IP address. It does not know your account, and nobody else gets its data.

4. What stays on your device

The app compiles the content of your repositories on your device and keeps it there, in the storage of the browser. That content never comes to our server. The app also keeps your progress, an opaque id of your account, the descriptions of your repositories, the theme that you choose, and a copy of itself, so that it works offline.

With no account, your progress and your list of repositories are only in this browser. If you clear the data of the browser for this site, you lose them. The app also keeps the time when you closed the banner about this, so that the banner comes back one day later. When you sign in with an email that has no account, you make a new account, and the app sends your progress and your list to it. When you sign in to an account that you already have, the app first deletes from this browser the progress of the learner with no account.

5. Cookies

With no account, Stemin sets no cookie. The app keeps its data in the storage of the browser (section 4). When you sign in, the server sets one cookie, sid. It holds a random session identifier and nothing else, the page scripts cannot read it, and it ends after 30 days or when you sign out. When you choose a theme, the app sets a second cookie, stemin.theme, for one year. The analytics set no cookie. There are no tracking cookies and no third-party cookies.

When you sign out, the app deletes your progress from the device. It keeps the compiled courses, which are public content, so that they open at once next time. Delete account clears all of it.

6. Other parties

• The host of a repository. Your device reads each repository directly from its host, for example GitHub, GitLab or Codeberg. That host sees your IP address, and its own policy applies.
• Mail delivery. When you ask for a sign-in code, a mail service delivers it, and sees the address and the code. A message from the contact form goes to us the same way, with your address. The server keeps neither.

We load no script, font or image from another site.

7. Your control

In the account menu of the app, Download gives you everything that the server keeps about you, in one JSON file. The only exceptions are the hashes of your email and of your sessions, which mean nothing to you. Delete account deletes your account and its data from the server, and clears the app from your device. The counters of attempts go away on their own, within about one hour.

8. Changes

We can change this policy at any time. The new policy applies when we put it on this page.

9. Contact

Write to us through the contact form.